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Why GAO Did This Study 

The Department of Homeland 
Security (DHS) plans to establish a 
program to strengthen 
management of the pre-entry, 
entry, status, and exit of foreign 
nationals who travel to the United 
States. The goals of the program, 
known as the United States Visitor 
and Immigrant Status Indicator 
Technology (US-VISIT), are to 
facilitate legitimate trade and 
travel, enhance national security, 
and adhere to U.S. privacy laws and 
policies. By congressional 
mandate, DHS is to develop and 
submit for approval an expenditure 
plan for US-VISIT that satisfies 
certain conditions, including being 
reviewed by GAO. GAO was asked 
to determine, among other things, 
whether the plan satisfies these 
conditions and to provide 
observations about the plan and 
DHS's management of the program. 



What GAO Recommends 



GAO is making a number of 
recommendations to the Secretary 
of DHS aimed at minimizing the 
risks facing US-VISIT, including 

(1) establishing an executive body, 
composed of appropriate 
stakeholder representatives, to 
guide and direct the program, be 
held accountable for the program's 
progress and outcomes, and 
address key program issues and 
make associated decisions and 

(2) taking steps to establish an 
effective program management 
capability. DHS concurred with our 
recommendations and stated that it 
has made progress toward 
addressing them. 

www.gao.gov/cgi-bin/getrpt7GAO-03-1083 

To view the full product, including the scope 
and methodology, click on the link above. 
For more information, contact Randolph C. 
Hite at (202) 512-3439 or hiter@gao.gov. 



What GAO Found 

DHS's fiscal year 2003 US-VISIT expenditure plan and related documentation 
partially satisfied the conditions imposed by the Congress, which include 
meeting the capital planning and investment control review requirements of 
the Office of Management and Budget (OMB). For example, DHS fulfilled the 
OMB requirement that agencies state whether projects are approved by 
investment review boards and reviewed by Chief Financial and Procurement 
Officers; the plan was conditionally approved by DHS's review board, which 
includes DHS's Chief Financial and Procurement Officers. On the other 
hand, OMB guidance requires that agency plans summarize life cycle costs 
and include a cost/benefit analysis that covers return on investment. DHS 
has not yet established a date and plan for developing these for US-VISIT, 
although program officials stated that they intend to do so. 

GAO also identified 10 factors (see figure) affecting US-VISIT and concluded 
that the program is a very risky endeavor. Some risk factors are inherent to 
the program, such as its mission criticality, its size and complexity, and its 
enormous potential costs. Others, however, arise from the program's 
relatively immature state of governance and management. For example, 
although the program has governmentwide scope, an accountable 
governance structure to direct and oversee the program that reflects this 
scope is not yet established. In addition, a US-VISIT program management 
capability has yet to be established, important aspects defining the 
program's operating environment are not decided, facility needs are unclear 
and challenging, and the mission value to be derived from the program's 
initial operating capability is unknown. Because of the risk factors, GAO 
concluded that it is uncertain that US- VISIT will be able to measurably and 
appreciably achieve DHS's stated goals for the program. Further, DHS's 
near-term investment in the program is at risk of not delivering promised 
capabilities on time and within budget and not producing mission value 
commensurate with investment costs. 

Factors That Collectively Make US-VISIT a Risky Endeavor 



Mission value of first 
increment is currently 
unknown 



Near-term facilities 
solutions pose 
challenges 



Mission is critical 



Operational context 
is unsettled 



Program management 
capability is not 
implemented 




Governance structure 
is not established 



Scope is large 
and complex 



Milestones are 
challenging 



Potential cost is 
significant 



Existing systems have 
known problems 
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Abbreviations 



ADIS Arrival Departure Information System 

APIS Advance Passenger Information System 

CCD Consular Consolidated Database 

CLAIMS 3 Computer Linked Application Information Management 
System 3 

CLASS Consular Lookout and Support System 

DHS Department of Homeland Security 

EA enterprise architecture 

IBIS Interagency Border Inspection System 

IDENT Automated Biometric Identification System 

INS Immigration and Naturalization Service 

IRB Investment Review Board 

IT information technology 

NIIS Non-Immigrant Information System 

NSEERS National Security Entry-Exit Registration System 

OMB Office of Management and Budget 

POE port of entry 

SA-CMM® Software Acquisition Capability Maturity Model® 

SEI Software Engineering Institute 

SEVTS Student Exchange Visitor Information System 

US- VISIT U.S. Visitor and Immigrant Status Indicator Technology 
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United States General Accounting Office 
Washington, D.C. 20548 



September 19, 2003 

The Honorable Thad Cochran 
Chairman 

The Honorable Robert C. Byrd 
Ranking Minority Member 
Subcommittee on Homeland Security 
Committee on Appropriations 
United States Senate 

The Honorable Harold Rogers 
Chairman 

The Honorable Martin Olav Sabo 
Ranking Minority Member 
Subcommittee on Homeland Security 
Committee on Appropriations 
House of Representatives 

Pursuant to the Consolidated Appropriations Resolution, 2003, 1 the 
Department of Homeland Security (DHS) submitted to Congress in June 
2003 its fiscal year 2003 expenditure plan for the United States Visitor and 
Immigrant Status Indicator Technology (US-VISIT) program. US-VISIT is a 
governmentwide program intended to improve the nation's capacity for 
collecting information on foreign nationals who travel to the United States, 
as well as control the pre-entry, entry, status, and exit of these travelers. 
The goals for US-VISIT are to facilitate legitimate travel and trade, enhance 
national security, and adhere to U.S. privacy laws and policies. As also 
required by the Consolidated Appropriations Resolution, 2003, we 
reviewed the expenditure plan. Our objectives were to (1) determine 
whether the US-VISIT fiscal year 2003 expenditure plan satisfies certain 
legislative conditions specified in the Consolidated Appropriations 
Resolution, 2003; (2) determine the status of our US-VISIT open 
recommendations; and (3) provide any other observations about the 
expenditure plan and DHS's management of US-VISIT. The specified 
legislative conditions are that the plan meet the capital planning and 
investment control review requirements established by the Office of 
Management and Budget (OMB), including OMB Circular A-ll, part 3; that 
it comply with the acquisition rules, requirements, guidelines, and systems 



^.L. 108-7 (Feb. 20, 2003). 
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acquisition management practices of the federal government; and that it be 
reviewed by GAO. 

On July 18, 2003, we provided your offices a written briefing detailing the 
results of our review This report summarizes and transmits this briefing. 
The full briefing, including our scope and methodology, is reprinted as 
appendix I. 

Concerning our first objective, DHS partially satisfied those legislative 
conditions specified in the Consolidated Appropriations Resolution, 2003, 
that are applicable to it. That is, the plan, including related program 
documentation and program officials' statements, satisfied or provided for 
satisfying many, but not all of the key aspects of (1) OMB's capital planning 
and investment control review requirements; and (2) federal acquisition 
rules, requirements, guidelines, and systems acquisition management 
practices. For example, DHS fulfilled the OMB requirement that agencies 
state whether projects are approved by investment review boards and 
reviewed by Chief Financial and Procurement Officers; the plan was 
conditionally approved by DHS's review board, which includes DHS's Chief 
Financial and Procurement Officers. On the other hand, OMB guidance 
requires that agency plans summarize life cycle costs and include a 
cost/benefit analysis that covers return on investment. DHS has not yet 
established a date and plan for developing a current life cycle cost and a 
cost/benefit analysis for US-VISIT, although program officials stated that 
they intend to do so. 

Concerning our second objective, DHS has initiated action to implement or 
has partially implemented most, but not all of the recommendations 
contained in our report on the fiscal year 2002 expenditure plan. 2 Each 
recommendation, along with the status of each, is summarized below. 

• We recommended that DHS develop a system security plan and privacy 
impact assessment. The department has action under way to address 
this recommendation. Specifically, DHS reported that it has defined 
security and privacy requirements and has drafted a security plan and a 
privacy impact assessment. 



2 U.S. General Accounting Office, Information Technology: Homeland Security Needs to 
Improve Entry Exit System Expenditure Planning, GAO-03-563 (Washington, D.C.: June 9, 
2003). 
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• We recommended that DHS ensure that controls in the area of 
acquisition planning, solicitation, requirements management, program 
management, contract tracking and oversight, and evaluation are 
implemented in accordance with the Software Engineering Institute's 
(SEI) guidance. 3 The department plans to implement this 
recommendation. Specifically, DHS has recently approved a program 
management structure that includes functions consistent with these 
controls; however, it has not yet developed explicit plans or time frames 
for defining and implementing them. 

• We recommended that DHS ensure that future expenditure plans are 
provided to the department's House and Senate Appropriations 
Subcommittees in advance of US-VISIT funds being obligated. With 
respect to the fiscal year 2003 expenditure plan, DHS partially satisfied 
this recommendation. Specifically, it provided this plan to the Senate 
and House Appropriations Subcommittees on Homeland Security in 
June 2003. However, following DHS's request for use of $5 to $7 million 
in March 2003, the April 2003 House Conference Report 4 recommended 
that DHS use $5 million for US-VISIT. DHS subsequently allocated the $5 
million to the US-VISIT program. 

• We recommended that DHS ensure that future expenditure plans fully 
disclose US-VISIT system capabilities, schedule, cost, and benefits. With 
respect to the fiscal year 2003 expenditure plan, DHS has partially 
satisfied this recommendation. Specifically, this plan describes high- 
level capabilities by increment, high-level schedule estimates, and 
categories of expenditures. However, the plan does not associate these 
categories of expenditure to incremental capabilities, time frames, and 
benefits. Moreover, the plan does not identify expected benefits in 
tangible, measurable, and meaningful terms, nor does it associate 
benefits with increments. 

Finally, we identified 10 factors that make US-VISIT a risky endeavor. Some 
of these risk factors are inherent to the program, and others are a product 
of the program's relatively immature state of governance and management. 
The specific risk factors that we identified are as follows: 



3 Carnegie Mellon Software Engineering Institute, Software Acquisition Capability 
Maturity Model®, Version 1.03 (March 2002) defines acquisition process management 
controls for planning, managing, and controlling software-intensive system acquisitions. 

4 H.R. Conf. Rep. No. 108-76, at 80 (2003). 
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• US-VISIT is critical to the department's mission in preventing the entry 
of persons who pose a threat to our nation into the United States. The 
missed entry of just one of these persons could have severe 
consequences. 

• US-VISIT is large in scope and complex. For example, the program is to 
(1) support a large governmentwide process involving multiple 
departments and agencies, (2) modify and expand facilities at over 150 
land ports of entry, and (3) interconnect about 20 existing systems. 

• To meet US-VISIT's daunting milestones, 5 DHS has chosen to implement 
temporary solutions, largely because over the last 7 years, limited 
progress has been made in addressing key legislative requirements. For 
example, to meet deadlines at land ports of entry, DHS plans to develop 
and implement interim, or temporary, system and facility solutions. 

• The program will be a costly undertaking. In February 2003, DHS 
estimated that the program would cost about $7.2 billion through fiscal 
year 2014. However, this estimate is outdated and does not include, for 
example, the State Department's cost to implement visas with 
biometrics, which we previously estimated could add as much as $15 
billion to the program's cost through 2014. 6 

• The performance of initial increments of the US- VISIT system depends 
on the performance of existing systems that are to be interfaced. Some 
of these systems, such as the Student and Exchange Visitor Information 
System 7 and the Computer Linked Application Information Management 
System 3, 8 have known system availability problems that could limit US- 
VISIT system performance. 



5 For example, the Immigration and Naturalization Service Data Management Improvement 
Act of 2000 (RL. 106-215, June 15, 2000) requires that US-VISIT be implemented at all air and 
sea ports of entry by December 31, 2003; at the 50 highest volume land ports of entry by 
December 31, 2004; and at all remaining ports of entry by December 31, 2005. 

6 U.S. General Accounting Office, Technology Assessment: Using Biometrics for Border 
Security, GAO-03-174 (Washington, D.C.: Nov 15, 2002). 

7 The Student and Exchange Visitor Information System contains information on foreign 
students. 

8 The Computer Linked Application Information Management System 3 contains information 
on foreign nationals who request benefits, such as change of status or extension of stay. 
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• US-VISIT is not currently directed and overseen by an accountable 
governance structure that reflects the program's governmentwide scope 
and that includes the appropriate leaders from each stakeholder 
organization, that is, those who can make and enforce decisions and 
commit resources. 

• The US-VISIT program office does not have the capabilities (people, 
processes, and tools) to effectively manage the program. For example, 
this office has not yet been adequately staffed, specific roles and 
responsibilities have not been defined, and acquisition management 
process controls have not been developed and implemented. Moreover, 
DHS has not defined specific plans and time frames for doing so. 

• Key information about the operational context surrounding US-VISIT 
that is necessary to effectively define, establish, and implement the 
program is not yet available. As a result, DHS is making certain 
assumptions and decisions in order to meet near-term deadlines, such as 
the use of a two-fingerprint biometric; these assumptions and decisions 
would require system rework if they prove inconsistent with subsequent 
operational context policy or standards decisions. 

• Construction of US-VISIT facility solutions, both interim and permanent, 
pose serious challenges for a number of reasons. For example, existing 
facilities do not support existing entry and exit processes at a number of 
land ports of entry, border crossing wait times are very sensitive to very 
small increases in processing times at certain high-volume land ports of 
entry, and interim facility solutions must satisfy yet-to-be defined 
program requirements. 

• The mission value to be gained from the initial US-VISIT operational 
capability planned for December 31, 2003, is not currently known. In 
particular, DHS has not defined specific, measurable benefits expected 
from this initial operating capability, in large part because it has yet to 
define the processes that will govern how entry and exit activities will 
be performed. This uncertainty is compounded by the fact that this 
initial operating capability is to be constrained by existing facilities and 
personnel and it is not to result in increases in border crossing wait 
times. 

In conclusion, US-VISIT is a risky undertaking because it is to support a 
critical mission, its scope is large and complex, it must meet a demanding 
implementation schedule, and its potential cost is enormous. Generally, 
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these risk factors are inherent to the program and cannot be easily 
changed. However, compounding these inherent risk factors are a number 
of others that are attributable to the program's current state of governance 
and management and its acquisition approach, as described above. Further, 
DHS did not fully satisfy the legislative conditions imposed by the Congress 
and has yet to fully implement our previous recommendations, both of 
which were aimed at reducing risk. Because of all these risk factors, it is 
uncertain that US-VISIT will be able to measurably and appreciably achieve 
DHS's stated goals of facilitating legitimate travel and trade, enhancing 
national security, and adhering to U.S. privacy laws and policies. Moreover, 
DHS's near-term investment in the program is at risk of not delivering 
promised capabilities on time and within budget, and not producing 
mission value commensurate with investment costs. Thus, it is imperative 
that the factors that contribute to this level of risk be addressed thoroughly 
and expeditiously. 



To address US-VISIT as a governmentwide program and to minimize the 
risks facing the program, we recommend that the Secretary of Homeland 
Security, in collaboration with cabinet officials from US-VISIT stakeholder 
departments and agencies, 

• establish and charter an executive body, chaired by the Secretary's 
designee, potentially co-chaired by the leadership from key stakeholder 
departments and agencies, and composed of appropriate senior-level 
representatives from DHS and each stakeholder organization, to guide 
and direct the US-VISIT program; and 

• direct this executive body to immediately take steps to (1) ensure that 
the human capital and financial resources are expeditiously provided to 
establish a fully functional and effective US-VISIT program office and 
associated management capability, (2) clarify the operational context 
within which US-VISIT must operate, and (3) decide whether proposed 
US-VISIT increments will produce mission value commensurate with 
costs and risks and disclose to the Congress planned actions based on 
this body's decisions. 

Further, we recommend that the Secretary, through the Under Secretary for 
Border and Transportation Security, direct the US-VISIT Program Director 
to expeditiously establish an effective program management capability, 
including immediately 



Recommendations for 
Executive Action 
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• defining program office positional roles, responsibilities, and 
relationships; 

• developing and implementing a human capital strategy that provides for 
staffing these positions with individuals who have the requisite core 
competencies (knowledge, skills, and abilities); 

• developing and implementing a plan for satisfying key SEI acquisition 
management controls, to include acquisition planning, solicitation, 
requirements development and management, project management, 
contractor tracking and oversight, evaluation, and transition to support; 

• developing and implementing a risk management plan and ensuring that 
all high risks and their status are reported regularly to the executive 
body; 

• defining performance standards for each US-VISIT system increment 
that are measurable and reflect the limitations imposed by relying on 
existing systems for these system increments; and 

• developing an analysis of incremental program costs, benefits, and risks, 
and providing this analysis to the executive body, to assist it in the 
body's deliberations and decision making. 



AgGIlCy Comments * n WI *itten comments on a draft of this report signed by the Director, US- 

c ~ J * VISIT, DHS concurred with our recommendations and stated that it has 

recently made progress toward addressing them. In particular, DHS stated 
that it has approved the proposed US-VISIT organizational structure and 
identified necessary staff positions, and that it is working with the Office of 
Personnel Management to draft position descriptions and prepare for 
recruitment. Also, it stated that the US-VISIT program office is staffed with 
51 detailees from various DHS components and agencies. Last, it stated 
that it has in place an Investment Review Board that has twice reviewed 
US-VISIT, has established a DHS framework for addressing policy 
questions, and has plans to establish a US-VISIT Advisory Council. DHS's 
comments are reprinted in appendix II. 



We are sending copies of this report to the Chairmen and Ranking Minority 
Members of other Senate and House committees and subcommittees that 
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have authorization and oversight responsibilities for homeland security. We 
are also sending copies to the Secretary of State and the Director of OMB. 
We also will make copies available to others upon request. In addition, the 
report will be available at no charge on the GAO Web site at 
http://www.gao.gov. 

Should you or your staff have any questions on matters discussed in this 
report, please contact me at (202) 512-3439. 1 can also be reached by E-mail 
at Hiter@gao.gov. Key contributors to this report were Seto Bagdoyan, 
Barbara Collier, Deborah Davis, Neil Doherty, Rebecca Gambler, Tamra 
Goldstein, James Houtz, Richard Hung, Tammi Nguyen, and Mark Tremba. 




Randolph C. Hite 

Director, Information Technology Architecture 
and Systems Issues 
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Appendix I 

Briefing to the Staffs of the Subcommittees on 
Homeland Security, Senate and House 
Committees on Appropriations 
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Subcommittees on Homeland Security 
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Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 
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Briefing Overview 


• Introduction 




• Objectives 




• Results in Brief 




• Background 




• Results 




• Legislative Conditions 




• oiaius ot rieconrirnenQcuions 




• Observations 




• Conclusions 




• Recommendations 




• Agency Comments 




• Attachment 1. Legislative History 




• Attachment II. Scope and Methodology 
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Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 
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Introduction 



Seven years ago, the Congress passed legislation that directed the former 
Immigration and Naturalization Service (INS) to develop an entry exit system. 
Pursuant to this and related legislative direction, 1 INS established the entry exit 
program about 16 months ago. Subsequently, INS was merged into the 
Department of Homeland Security (DHS), and the entry exit program was renamed 
the United States Visitor and Immigrant Status Indicator Technology (US-VISIT). 
US-VISIT is a governmentwide program that is to improve the processes, policies, 
and systems used to collect information on foreign nationals who travel to the 
United States, and to track entries, exits, and stays of travelers. 



DHS's stated goals for US-VISIT are to 

• facilitate legitimate travel and trade, 

• enhance national security, and 

• adhere to U.S. privacy laws and policies. 



1 See attachment I for a listing of relevant legislation. 
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Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 
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Introduction 



The US-VISIT program involves the interdependent application of people, processes, 
technology, and facilities. 



P 



Inspectors, 
border patrol agents, 
program management staff, 
consular officials, 
investigators, and 

adjudicators ^"US-VISIT 

program 



Pre-entry, entry, status, 
and exit management 
policies and 
procedures 




US-VISIT system 




Border facilities 



Source: GAO. 

Note: GAO analysis based on DHS data. 
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Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 



L GAP 

Accountability * Integrity * Reliability 



Introduction 



The Consolidated Appropriations Resolution, 2003, 1 prohibits DHS from obligating 
any funds appropriated in the act for the entry exit system (now US-VISIT), until it 
submits a plan for expenditure that satisfies the following legislative conditions. 

• It meets the capital planning and investment control review requirements 
established by the Office of Management and Budget (OMB), including OMB 
Circular A-1 1 , part3. 2 

• It complies with the acquisition rules, requirements, guidelines, and systems 
acquisition management practices of the federal government. 

• It is reviewed by GAO. 



1 P.L 108-7 (Feb. 20, 2003). 

2 OMB Circular A-1 1 establishes policy for planning, budgeting, acquisition, and management of federal 
capital assets. 

5 
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Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 
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Introduction 



In fiscal year 2003, Justice requested $380 million for the entry exit program (now 
US-VISIT)— $362 million in new funding and $18 million in fiscal year 2003 base 
resources. 

• In conjunction with the Consolidated Appropriations Resolution, 2003, the 
conference report 1 recommended $362 million for the entry exit system (now 
US-VISIT) and related information technology (IT) infrastructure upgrades. 

• According to DHS officials, the $18 million in base resources was to come from 
a user fee account. However, according to these officials, given the decrease 
in user fee receipts since September 1 1 , 2001 , it is unclear whether the $18 
million will be available for the US VISIT program. 

DHS submitted its fiscal year 2003 expenditure plan for $375 million 2 on June 5, 
2003, to its House and Senate Appropriations Subcommittees on Homeland 
Security. 



1 H.R. Conf. Rep. No. 108-10, at 623 (2003). 

2 In April 2003, H.R. Conf. Rep. No. 108-76 at 80 (2003), recommended that DHS use $5 million for US- 
VISIT. The $5 million was not included in the expenditure plan submitted to the Appropriations 
Subcommittees in June 2003. 
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Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 
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Objectives 



As agreed, our objectives were to 

1 . determine whether the US-VISIT fiscal year 2003 expenditure plan satisfies the 
legislative conditions, 

2. determine the status of our US-VISIT open recommendations, and 

3. provide any other observations about the expenditure plan and DHS's 
management of US-VISIT. 



We conducted our work at DHS headquarters in Washington, D.C., from April 
through July 2003 in accordance with generally accepted government auditing 
standards. Details of our scope and methodology are given in attachment II. 
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Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 
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Results in Brief: Objective 1 
Legislative Conditions 


DHS's expenditure plan partially satisfies the legislative conditions. 


Legislative conditions 


Fully satisfies 1 Partially satisfies 2 Does not satisfy 3 


1 . Meets the capital planning and 
investment control review 
requirements established by OMB, 
including OMB Circular A-1 1 , part 3. 


V 


2. Complies with the acquisition rules, 
requirements, guidelines, and 
systems acquisition management 
practices of the federal government. 


V 


3. Is reviewed by GAO. 




1 Satisfies or provides for satisfying every aspect of the condition that we reviewed. 

2 Satisfies or provides for satisfying many, but not all, key aspects of the condition that we reviewed. 

3 Satisfies or provides for satisfying few, if any, of the key aspects of the condition that we reviewed. 
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Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 



Results in Brief: Objective 2 
Open Recommendations 



Status of DHS actions to implement our open recommendations. 



Status 

GAO Open recommendations Complete Partially complete In progress Planned 

1 . Develop a system security plan and , 
privacy impact assessment. 

2. Ensure that controls in the area of 
acquisition planning, solicitation, 
requirements management, project 

management, contract tracking and ^ 
oversight, and evaluation are 
implemented in accordance with SEI 1 
guidance. 

(continued next slide) 

1 The Software Acquisition Capability Maturity Model® developed by Carnegie Mellon University's Software 
Engineering Institute (SEI) defines acquisition process management controls for planning, managing, and 
controlling software-intensive system acquisitions. 

9 
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Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 



Results in Brief: Objective 2 
Open Recommendations 

Status 

GAO Open recommendations Complete Partially complete In progress Planned 
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3. Ensure that future expenditure plans 
are provided to DHS's House and 
Senate Appropriations 
Subcommittees in advance of US- 
VISIT funds being obligated. 

4. Ensure that future expenditure plans 
fully disclose what US-VISIT system 
capabilities and benefits are to be 
delivered, by when, and at what cost. 



1 With respect to the fiscal year 2003 expenditure plan. 
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Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 



Results in Brief: Objective 3 
Observations: Risk Factors 

US-VISIT is a high risk endeavor. We have identified 10 risk factors affecting US- 
VISIT: 

• Mission is critical. The missed entry of one person who poses a threat to the 
United States could have severe consequences. 

• Scope is large and complex. Controlling the pre-entry, entry, status, and exit 
of millions of travelers is a large and complex process. 

• Milestones are challenging. Progress and current status of the program 
makes satisfying legislatively mandated milestones difficult. 

• Potential cost is significant. DHS has estimated that the program will cost 
$7.2 billion through fiscal year 2014, and this estimate does not include all 
costs and may underestimate some others. 

• Existing systems have known problems. The program is to initially rely on 
existing systems with known problems that could limit US-VISIT performance. 
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Results in Brief: Objective 3 
Observations: Risk Factors 



• Governance structure is not established. The program is not currently 
governed by an accountable body that reflects its governmentwide scope and 
that can make and enforce decisions and commit resources for all program 
stakeholders. 

• Program management capability is not implemented. The program office is 
not yet adequately staffed, roles and responsibilities are not yet clearly defined, 
and acquisition management processes are not yet established. 

• Operational context is unsettled. Operational issues have not been decided, 
such as which rules and standards will govern implementation of biometrics 
technology. 

• Near-term facilities solutions pose challenges. Interim facility planning for 
high-volume land ports of entry (POEs) must satisfy demanding as well as yet- 
to-be defined requirements. 

• Mission value of first increment is currently unknown. The benefits versus 
costs of the first increment are not yet known. 
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Risk Factors Affecting US-VISIT 









Mission value of first 
increment is currently 
unknown 




Mission is critical 




Scope is large 
and complex 




Near-term facilities 
solutions pose 
challenges 


^US-VISIT^ 
\ is / 


Milestones are 
challenging 




Operational context 
is unsettled 


\high risk/ 


Potential cost is 
significant 




Program management 
capability is not 
implemented 




Governance structure 
is not established 




Existing systems have 
known problems 





Source: GAO. 



Unless these risk factors are effectively addressed, US-VISIT is likely to fall short of 
envisioned expectations. 
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Results in Brief 



To address these risk factors, we are making recommendations to the Secretary of 
Homeland Security. 

We provided DHS a draft of this briefing. In its oral comments, DHS agreed with 
our findings, conclusions, and recommendations. 
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Background 
Border Inspection by POE 



All persons that legally enter the United States must pass through one of more than 
300 land, sea, or air ports of entry (POEs), and must undergo a primary inspection. 
In fiscal year 2002, about 440 million primary inspections were conducted on 
foreign nationals and U.S. citizens. 
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Number of Number of Percentage of 

Type of POEs POEs inspections inspections 



Land 


165 


358,373,569 


81 


Air 


123 


69,679,190 


16 



Sea 42 12,369,035 3 



Total 330 440,421,794 100 

Source: DHS. 

Note: GAO analysis based on DHS data. 
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Background 
US-VISIT Overview 



US-VISIT is a governmentwide endeavor intended to facilitate legitimate travel and 
trade, enhance national security, and adhere to U.S. privacy laws and policies by 

• collecting, maintaining, and sharing information on individuals who enter and 
exit the United States; 

• identifying individuals who (1) have overstayed or violated the terms of their 
visit; (2) can receive, extend, or adjust their immigration status; and (3) should 
be apprehended or detained by law enforcement officials; 

• detecting fraudulent travel documents, verifying traveler identity, and 
determining traveler admissibility through the use of biometrics; and 

• facilitating information sharing and coordination within the border management 
community. 
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Background 
US-VISIT Organization 



Within DHS, 1 organizational responsibility for the US-VISIT program is within the 
Border and Transportation Security Directorate. 

In June 2003, DHS established a US-VISIT program office with responsibility for 
managing the acquisition, deployment, operation, and sustainment of the US-VISIT 
system and supporting people (e.g., inspectors), processes (e.g., entry exit policies 
and procedures), and facilities (e.g., inspection booths) associated with the 
program. 

The following graphic shows the organizational ownership for the US-VISIT 
program. 
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1 1n January 2003, we designated the implementation and transformation of DHS as a high risk program for 
the following three reasons: (1) the size and complexity of the undertaking, (2) the wide array of existing 
challenges of the component agencies being merged within DHS, and (3) the potentially serious 
consequences of DHS's failure to effectively carry out its mission. (U.S. General Accounting Office, Major 
Management Challenges and Program Risks: Department of Homeland Security, GAO-03-102 (Washington, 
D.C.: January 2003)). 
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Background 
US-VISIT Organization 



Organizational Placement of US-VISIT Program (partial DHS organization chart) 



Department of 
Homeland Security 
Secretary 



US-VISIT 



Bureau of Customs 
& Border Protection 



-INS inspection services 
-Agricultural Quarantine 
Inspection program 

-Border Patrol 

-Customs Service 
{including canine officers) 



Deputy Secretary 



Under Secretary for Border 
& Transportation Security 



Bureau of Immigration 
& Customs Enforcement 



-INS investigative and 
enforcement functions 

-Customs investigative and 
enforcement (including air 
and marine) functions 
-Federal Protective Service 



Director 
Bureau of Citizenship 
& Immigration Services 



INS benefits and 
immigration services 
functions 



Transportation Security 
Administration 



-Aviation security functions 
(including passenger and 
baggage screening 
operations and air marshals) 
-Maritime and land security 
functions 

-Intelligence analysis and 
dissemination activities 



Source: GAO. 



Note: GAO analysis based on DHS data. As of May 2003, the US-VISIT program office reports directly to 
the Under Secretary for Border and Transportation Security. 
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Acquisition Strategy 

DHS plans to deliver US-VISIT capability incrementally. Currently DHS has defined 
four increments, with Increments 1 through 3 being interim, or temporary, solutions, 
and increment 4 being the strategic solution and consisting of a series of 
increments. Increments 1 through 3 include the interfacing and enhancement of 
existing system capabilities and the deployment of these capabilities at air, sea, 
and land POEs; the design and construction of interim facilities 1 at land POEs; and 
the development and implementation of revised border inspection procedures. 



1 DHS is planning to construct interim, or temporary, facilities at land POEs to meet established milestones, 
while concurrently developing permanent solutions at these POEs. 
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According to DHS, Increment 1 is to deliver an initial system operating capability to 
all air and sea POEs by December 31 , 2003, that includes 

• recording the arrival and departure of foreign nationals using passenger and 
crew manifest data, 

• identifying travelers who have overstayed their visits or changed their visitor 
status, and 

• interfacing seven existing systems that contain data about foreign nationals. 

Increment 1 is to also verify travelers' identities upon entry into the United States 
through the use of biometrics and checks against watch lists (e.g., the Interagency 
Border Inspection System — IBIS) at air POEs and 13 of 42 sea POEs, but only for 
those cruise lines that currently have inspections stations. 

Increment 1 is also to include developing policies and procedures and providing the 
associated training for an interim inspection process. 

Increment 1 may include an exit capability beyond the capture of the manifest data. 
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Increment 1 is not intended to include the installation or acquisition of additional 
facilities at air and sea POEs, or employment of additional inspectors. 

Increment 2 is to deploy Increment 1 system capability and design and construct 
interim facilities (e.g., additional inspection booths) at the 50 highest volume land 
POEs by December 31 , 2004. It is also to include 

• the use of radio frequency technology 1 for vehicles and pedestrians that are 
pre-cleared, and 

• the use of technology to read travel documents with biometrics. 2 

Increment 3 is to deploy Increment 2 system capability and design and construct 
interim facilities at all remaining land POEs by December 31 , 2005. 

Increment 4 is to deliver a new, yet-to-be-defined, integrated system solution to a 
yet-to-be-defined number of POEs by December 31 , 2006. 



1 DHS plans to issue radio frequency-enabled proximity cards. As the person or vehicle passes through the 
inspection lane, the data on the card are read by an antenna and displayed on the inspector's screen. 

2 By October 26, 2004. 
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For the system, DHS plans are to award a single, indefinite-delivery/indefinite- 
quantity (IDIQ) 1 type contract to a prime contractor capable of integrating existing 
and new business processes and technologies. DHS plans to issue a request for 
proposal for the prime contractor in November 2003. The prime contractor is to be 
responsible for Increment 4 and is to assist in the deployment of Increments 2 and 
3. DHS plans to use existing contractors to interface and enhance the existing 
systems for Increment 1 . 

For facilities, the department plans to award contracts for the design and 
construction of interim facilities at each land POE through the General Services 
Administration (GSA). DHS is working with GSA to obligate $17 million for the 
award of interim facilities design contracts beginning in August 2003. DHS plans to 
award interim facilities construction contracts for the 50 highest volume land POEs 
through GSA beginning in February 2004 using anticipated fiscal year 2004 funds. 



1 An IDIQ contract is a flexible contract that provides for an indefinite quantity, within stated limits, of supplies 
or services during a fixed period of time. The government schedules deliveries or performance by placing 
orders with the contractor. 
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For human capital, DHS has not yet defined its strategy. However, for Increment 1 , 
it does not plan to acquire any additional inspection staff. According to program 
officials, the department is developing a training plan for inspectors for Increment 1 , 
and it expects to complete training by the end of December 2003. 

DHS is currently developing the policies, procedures, and guidance for 
implementing Increment 1 . It expects to complete development by the end of 
October 2003. 



23 



Page 31 



GAO-03-1083 Homeland Security 



Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 



Background 
Component Systems 



Component Systems 

US-VISIT (Increments 1 through 4) is to include the interfacing and integration of 
over 20 existing systems. For example, Increment 1 includes the following existing 
systems: 

• Arrival Departure Information System (ADIS), a database that stores traveler 
arrival and departure data and can perform query functions; 

• Advance Passenger Information System (APIS), a system that captures arrival 
and departure manifest information; 

• Interagency Border Inspection System (IBIS), a system that maintains lookout 
data and interfaces with other agencies databases, and is currently used by 
inspectors at POEs to verify traveler information and modify data; 

• Automated Biometric Identification System (IDENT), a system that collects and 
stores biometric data for foreign visitors; 
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• Student Exchange Visitor Information System (SEVIS), a system that contains 
information on foreign students; and 

• Computer Linked Application Information Management System (CLAIMS 3), a 
system that contains information on foreign nationals who request benefits, 
such as change of status or extension of stay. 

• Consular Consolidated Database (CCD), a system that includes information on 
whether a visa applicant has previously applied for a visa or currently has a 
valid U.S. visa. 
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GAO's Review of Fiscal Year 2002 Expenditure Plan 

In our report on the fiscal year 2002 expenditure plan, 1 we concluded that 

• the plan partially satisfied the legislative conditions; 

• INS intended to acquire and deploy a system with functional and performance 
capabilities consistent with the general scope of capabilities under various 
laws; and 

• the plan did not provide sufficient information to allow Congress to oversee the 
program. 



1 U.S. General Accounting Office, Information Technology: Homeland Security Needs to Improve Entry Exit 
System Expenditure Planning, GAO-03-563 (Washington, D.C.: June 9, 2003). 
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Accordingly, we made recommendations, including 

• developing a system security plan and privacy impact assessment; 

• ensuring that controls in the area of acquisition planning, solicitation, 
requirements development and management, project management, contract 
tracking and oversight, and evaluation be implemented in accordance with SEI 
guidance; 

• ensuring that future expenditure plans be provided to the department's House 
and Senate Appropriations Subcommittees in advance of US-VISIT funds 
being obligated; and 

• ensuring that future expenditure plans fully disclose US-VISIT system 
capabilities, schedule, cost, and benefits to be delivered. 
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Fiscal Year 2003 Expenditure Plan Summary (see next slides for descriptions) 


Areas of expenditure 


Amount 


Proof of Concept Demonstrations: NSEERS reimbursement 

NSEERS 

Facial Verification Test 
System Enhancement & Infrastructure Upgrades 
POE IT and Communication Upgrades 
Facilities Planning, Analysis, & Design 
Training 

Program Management Support 
Operations & Systems Sustainment 


$ 10,500,000 
9,500,000 
1 ,500,000 
155,000,000 
85,000,000 
60,000,000 
3,500,000 
30,000,000 
20,000,000 


Total 


$ 375,000,000 1 


Source: DHS. 

1 1n April 2003, H.R. Conf. Rep. No. 108-76 at 80 (2003), recommended that DHS use $5 million for US- 
VISIT. The $5 million was not included in the expenditure plan submitted to the Appropriations 
Subcommittees in June 2003. 
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Descriptions 

Proof of Concept Demonstrations: This area includes reimbursement to DHS's 
Bureau of Citizenship and Immigration Services for previously conducted 
registration activities associated with the National Security Entry-Exit Registration 
System (NSEERS). 1 Costs in this area also include those for software changes 
made to IDENT to accommodate NSEERS, for the purchase and deployment of 
additional IDENT/ENFORCE workstations to POEs and district offices, and for 
training staff on these system changes. In addition, this area includes a pilot with 
the Australian government to test facial recognition, in which the Australian 
government will provide a select group of commercial pilots traveling between 
Australia and the United States with passports that have biometrics encoded on a 
chip; these passports will allow DHS to test the reading of the biometric information 
and to conduct facial verification matching tests. 

1 NSEERS consists of (1) a modified version of the Enforcement Case Tracking System (ENFORCE), 
(2) deployments of the Automated Biometric Identification System (IDENT), and (3) updated polices and 
procedures covering the registration of certain nonimmigrants. ENFORCE is a case management system 
that supports the apprehension and booking process for illegal aliens. IDENT is a database of more than 
4.5 million foreign visitors' fingerprints (two prints) and photos. 
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System Enhancement & Infrastructure Upgrades: This area includes the 
enhancement of existing information systems, telecommunications upgrades 
between the Justice and Customs data centers, an additional server to 
accommodate increased workload, and wide-area network upgrades to support 
additional processing and bandwidth requirements relative to the transmission of 
biometrics data. 

POE IT and Communication Upgrades: This area includes upgrades to the 
hardware (e.g., desktop computers, scanners, biometric devices) and 
communications infrastructure at the POEs. 
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Facilities Planning, Analysis, & Design: This area includes modeling air, sea, 
and the 50 highest volume land POEs for interim facilities and planning for 
permanent facilities; conducting environmental assessments; acquiring space for 
US-VISIT enrollment centers at the 50 highest volume land POEs; developing site 
plans; awarding design contracts for interim facilities at the 50 highest volume land 
POEs; conducting feasibility studies and developing master plans to begin 
collecting data and coordinating existing activities and projects for future 
requirements; and providing facility-related program and project management 
support. 

Training: This area includes initial training for personnel to use the US-VISIT 
system. 

Program Management Support: This area includes establishing a program 
management office to manage the US-VISIT program and engaging program 
management support contractors. 

Operations & Systems Sustainment: This area includes increased maintenance 
and technical support to meet the system performance requirements. 
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US-VISIT Available Appropriations, DHS Allocations, and Obligations for 
Fiscal Year 2002 and 2003 





Available 


DHS allocations 




Fiscal year 


appropriations (millions) 1 


(millions) 


Obligated (millions) 2 


FY 2003 


$ 380.0 


$ 52.5 3 


$4.2 


FY 2002 


13.3 


4 


3.2 4 


Total 


$ 393.3 




$7.4 



Source: DHS. 

1 Of the $449.8 million lump sum appropriated for Enforcement and Border Affairs in the Department of 
Defense and Emergency Supplemental Appropriations for Recovery from and Response to Terrorist Attacks 
on the United States Act, 2002 (P.L.107-1 17), the conference report (H.R. Conf. Rep. No. 107-350, at 416 
(2001)) recommended that INS use $13.3 million in appropriations for the entry exit system (now US- 
VISIT). This amount is available until expended. Of the $2.8 billion lump sum appropriated for Immigration 
Enforcement and Border Affairs for fiscal year 2003, the conference report (H.R. Conf. Rep. No. 108-10, at 
623 (2003)) recommended that INS use $362 million for what is now US-VISIT. These funds expire at the 
end of fiscal year 2003. According to DHS officials, an additional $18 million in base resources was to be 
available from a user fee account. Given the decrease in user fee receipts since September 1 1 , 2001 , these 
officials stated that the $18 million may not be available for the US-VISIT program. 



32 



Page 40 



GAO-03-1083 Homeland Security 



Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 



k O A (~\ Background 
^ ^ " Funding Approvals 



Accountability * Integrity * Reliability 



2 As of June 12, 2003. 

3 In April 2003, H.R. Conf. Rep. No. 108-76, at 80 (2003), recommended that DHS use $5 million for US- 
VISIT. DHS allocated this $5 million to the US-VISIT program. After submitting the expenditure plan to its 
appropriations subcommittees in June, DHS allocated $47.5 million to the US-VISIT program. 

4 On August 2, 2002, the Congress enacted the 2002 Supplemental Appropriations Act for Further 
Recovery From and Response to Terrorist Attacks on the United States (P. L. 107-206, Aug. 2, 2002), which 
prohibited INS from obligating funds for the entry exit system (from either of the two supplemental 
appropriations) until the agency submitted an expenditure plan to the appropriations committees that 
satisfied certain legislative conditions imposed by the act. Before August 2, 2002, the former INS had 
obligated $3.2 million. 
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Background 
US-VISIT Timeline 



US-VISIT Timeline 



March 2002 



Entry Exit 
program office 
established 



Oct 1 , 2002 



Visa Waiver 
System 1 and 
NSEERS 
operational 



Nov 15, 2002 



First 

expenditure 
plan 

submitted 



April 2003 



Entry Exit 

system 

became 

US-VISIT 

system 



June 5, 2003 



Second 

expenditure 

plan 

submitted 



August 2003 



Begin issuing 
design contracts 
for interim facilities 
at 50 highest 
volume land POEs 



November 2003 



Issue RFP for 

system 

integration 



February 2004 



Begin issuing 
construction 
contracts for 
interim facilities at 
50 highest volume 
land POEs 




December 31 , 2003 



Implement the system at 
all air and sea POEs 



October 26, 2004 



Read U.S. and visa waiver 
biometrically-enabled 
travel documents 



December 31 , 2004 



Implement the system at 
50 highest volume land 
POEs 



December 31 , 2005 



Implement the system at 
all remaining land POEs 



Source: GAO. 

Note: GAO analysis of DHS data. 

1 The Visa Waiver System electronically collects arrival and departure information for all passengers and crew members who 
are provided a waiver and who arrive and depart U.S. airports and seaports. 
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Objective 1 Results 
Legislative Conditions 



US-VISIT expenditure plan partially satisfies the legislative conditions. 

Condition 1 partially met. The plan, including related program documentation and 
program officials' statements, partially meets the capital planning and investment 
control review requirements established by OMB, including OMB Circular A-1 1 , 
part 3, which establishes policy for planning, budgeting, acquisition, and 
management of federal capital assets. 

Details of our analysis are shown on the table that follows. 
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Objective 1 Results 
Legislative Conditions 



Examples of A-1 1 conditions 



Results of our analysis 



Indicate whether the project was 
approved by Investment Review Board 
(IRB) and reviewed by Chief Financial 
and Procurement Officers. 



The plan was conditionally approved by DHS's IRB, which is 
chaired by the Deputy Secretary and composed of department 
executives, including DHS's Chief Financial and Procurement 
Officers. 



Provide justification and describe 
acquisition strategy. 



The plan provides a high-level justification and description of 
the acquisition strategy for Increment 1 . DHS plans to use 
existing contracts to interface and enhance existing systems 
for Increment 1 . 



Summarize life cycle costs and 
cost/benefit analysis, including the 
return on investment. 



DHS does not have current life cycle costs nor a current 
cost/benefit analysis for US-VISIT, but plans to develop these. 
However, a date and plan fordoing so have not been 
established. 1 



Address enterprise architecture. 



The plan states that US-VISIT is identified in DHS's enterprise 
architecture (EA), but it does not explain how this project 
conforms to DHS's EA, which is currently under development. 
Further, DHS officials could not provide evidence of US- 
VISIT's alignment with DHS's EA activities. 1 



Address security and privacy. 



According to program officials, security and privacy 
requirements have been defined, and a draft security plan and 
privacy assessment is currently under review. 



1 These areas are more fully discussed in the observation section of the briefing. 
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Objective 1 Results 
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Condition 2 partially met. The plan, including related program documentation and 
program officials' statements, partially complies with the acquisition rules, 
requirements, guidelines, and systems acquisition management practices of the 
federal government. These provide a management framework based on the use of 
rigorous and disciplined processes for planning, managing, and controlling the 
acquisition of IT resources, including acquisition planning, solicitation, requirements 
development and management, project management, contract tracking and 
oversight, and evaluation. 

Details of our analysis are shown on the table that follows. 
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Objective 1 Results 
Legislative Conditions 



Examples of practices Results of our analysis 



Acquisition planning.^ 
Ensures that reasonable 
planning for the 
acquisition is conducted, 
including, among other 
things, developing an 
acquisition strategy and 
plan, determining the cost 
and schedule, identifying 
risks, and defining 
requirements. 

Project management^ 
Provides for the 
management of activities 
within the project office 
and supporting 
contractors to ensure a 
timely, efficient, and cost- 
effective acquisition. 



For various reasons, including the recent transition to DHS, many of the 
acquisition planning documents that had been prepared for the former entry exit 
system are outdated. For example, INS had developed an acquisition plan, as 
required by INS acquisition policies and procedures that outlined its approach and 
strategy for acquiring the entry exit system. According to DHS officials, the plan is 
no longer current. 

DHS officials stated that they have updated some of these acquisition planning 
documents, submitted them to the IRB on June 30, 2003, and plan to meet with 
the IRB on July 1 7, 2003. DHS plans to update additional planning documents by 
August 7, 2003. For example, DHS plans to update its acquisition plan and 
develop a life cycle cost estimate and risk management plan for Increment 1 . 
According to US-VISIT program officials, interfacing and enhancing existing 
systems under Increment 1 are being managed according to the former INS's 
SDLC. 2 However, they could not provide evidence to support this statement; 
because of time constraints, we did not verify whether these contractors and 
associated DHS acquisition entities were following the SDLC. 

These officials also stated that US-VISIT will transition to DHS's SDLC when it is 
completed. However, they did not know when the DHS SDLC would be complete, 
and therefore when US-VISIT will transition. 



These practices are addressed in our observations section. 
2 An SDLC (Systems Development Life Cycle) is a management process that specifies, for a series of "cradle to grave" phases, 
the development activities to be performed, products to be generated, and the decision points to determine whether the project is 
ready for the next phase. 
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Condition 3 met. The plan satisfies the requirement that it be reviewed by GAO. 
Our review was completed on July 18, 2003. 
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Open Recommendation 1: Develop a system security plan and privacy impact 
assessment. 

Status: In progress 

The expenditure plan states that adequate security and privacy related measures 
are to be built into the US-VISIT system and that these measures will comply with 
emerging DHS security policies, relevant security-related laws, OMB circulars, and 
privacy guidelines of the federal Chief Information Officer Council's best practices. 

According to program officials, system security and privacy requirements have 
been defined, and a draft security plan and privacy assessment is currently under 
review. 
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Open Recommendation 2: Ensure that controls in the area of acquisition 
planning, solicitation, requirements development and management, project 
management, contract tracking and oversight, and evaluation be implemented in 
accordance with SEI guidance. 

Status: Planned 

DHS has recently approved a program management structure that includes 
functions consistent with these acquisition management controls: acquisition 
planning, solicitation, requirements development and management, project 
management, contract tracking and oversight, and evaluation. According to the US- 
VISIT Program Director, these functions will be performed consistent with SEI's 
guidance. However, the department does not currently have explicit plans and 
associated time frames for developing and implementing these acquisition 
management controls. 
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Open Recommendation 3: Ensure that future expenditure plans be provided to 
the Department's House and Senate Appropriations Subcommittees in advance of 
US-VISIT funds being obligated. 

Status: Partially complete 

In fiscal year 2003, Justice requested $380 million for the entry exit program (now 
US-VISIT)— $362 million in new funding and $18 million in fiscal year 2003 base 
resources. 1 In conjunction with the Consolidated Appropriations Resolution, 2003, 
the conference report 2 recommended $362 million for the entry exit system (now 
US-VISIT) and related IT infrastructure upgrades. 

In June 2003, DHS provided its fiscal year 2003 expenditure plan to the Senate 
and House Appropriations Subcommittees on Homeland Security. In April 2003, 
H.R. Conf. Rep. No. 108-76, at 80 (2003), recommended that DHS use $5 million 
for US-VISIT. DHS allocated this $5 million to the US-VISIT program. 

1 According to DHS officials, the $18 million in base resources was to come from the user fee account. 
However, according to these officials, given the decrease in user fee receipts since September 1 1 , 2001 , it is 
unclear whether that $18 million will be available for the US-VISIT program. 

2 H.R. Conf. Rep. No. 108-10, at 623 (2003). 
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Open Recommendation 4: Ensure that future expenditure plans fully disclose US- 
VISIT system capabilities, schedule, cost, and benefits to be delivered. 

Status: Partially complete 

The expenditure plan identifies high-level capabilities by increment, such as 

• recording the arrival and departure of foreign nationals using passenger and 
crew manifest data, 

• implementing biometrics, and 

• being interoperable with other entities, including law enforcement and 
intelligence agencies. 

The plan also identifies a high-level schedule for implementing the system. For 
example, Increment 1 is to be implemented by December 31, 2003; Increment 2 by 
December 31 , 2004; and Increment 3 by December 31 , 2005. 
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The plan also includes categories of expenditures, such as system enhancements 
and infrastructure upgrades, facilities planning, analysis and design, and POE IT 
and communications upgrades. However, the plan does not explicitly associate 
costs with incremental capabilities, time frames, and benefits. For example, the 
plan does not state how much of the $85 million for POE IT and communications 
upgrades DHS plans to use for Increment 1 or for other increments. 

The plan identifies high-level goals for Increment 1 (i.e., positively impact national 
security and overall efforts in the war against terrorism). However, it does not 
identify expected benefits in tangible, measurable, and thus meaningful terms, nor 
does it associate benefits with increments. Therefore, it does not provide the basic 
data needed to measure return on investment. US-VISIT program officials stated 
that they intend to estimate program costs and benefits, but they did not have time 
frames for doing so. 
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Observation: US-VISIT is a high risk endeavor. 

Ten separate factors collectively expose the US-VISIT program to a high level of 
risk. Some of these risk factors are inherent to the program, such as those 
associated with its mission criticality and complexity. Others are a product of the 
program's relatively immature state of governance and management. Unless these 
risk factors are effectively addressed, US-VISIT is likely to fall short of envisioned 
expectations. 
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a. Mission is critical. 

• In fiscal year 2002, there were about 279 million inspections of foreign 
nationals at U.S. POEs. The missed entry of just one person who poses a 
threat to the United States can have severe consequences. One of DHS's 
critical missions is to prevent such an entry, and it intends to rely heavily on 
US-VISIT to help it do so. 

• Additionally, the US-VISIT system is to assist law enforcement in identifying 
those visitors who overstay or otherwise violate the terms of their visas. 

• Further, in announcing the US-VISIT system, the Under Secretary stated that 
the system would "give America a 21st Century 'smart border' — one that 
speeds through legitimate trade and travel, but stops terrorists in their tracks." 




GAP 

Accountability * Integrity * Reliability 



46 



Page 54 



GAO-03-1083 Homeland Security 



Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 



L GAP 

Accountability * Integrity * Reliability 



Objective 3 Results 
Observations: Complexity 



b. Scope is large and complex. 

• US-VISIT is to support and refine a large and complex governmentwide 
process involving multiple departments and agencies. This process is to 
control the pre-entry, entry, status, and exit of hundreds of millions of foreign 
national travelers to and from the United States at over 300 air, sea, and land 
POEs. It also requires the modification and expansion of facilities at over 150 
land POEs. The graphic below depicts the high-level border security 
processes. The following graphics depict the subprocesses. 




Sources: GAO (data), Nova Development Corp. (images). 
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Simplified Diagram of Current Pre-entry Process 
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Sources: GAO (data), Nova Development Corp. (images), 

1 The Consular Lookout and Support System (CLASS) is a name check system that contains records of people who may be 
ineligible to receive a passport or visa. 
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Objective 3 Results 
Observations: Complexity 



Simplified Diagram of 
Current Entry Process 
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Form I-94 data and reports 
information on overstays. 
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Sources: GAO (data), Nova Development Corp. (images). 
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Simplified Diagram of the Current Status Process 
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Sources: GAO (data), Nova Development Corp. (images). 



1 The National Crime Information Center (NCIC) provides information on wanted persons and criminal histories. 
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Simplified Diagram of the Current Exit Process 
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Sources: GAO (data), Nova Development Corp. (images). 
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As mentioned previously, US-VISIT (Increments 1 through 4) is to include the 
interfacing and integration of over 20 existing systems. Increment 1 includes the 
following seven existing systems: 

• Arrival Departure Information System, 

• Advance Passenger Information System, 

• Interagency Border Inspection System, 

• Automated Biometric Identification System, 

• Student Exchange Visitor Information System, 

• Computer Linked Application Information Management System, and 

• Consular Consolidated Database. 

The following graphic shows the systems and their relationships. 
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Objective 3 Results 
Observations: Complexity 



Simplified Diagram of US-VISIT Increment 1 Component Systems and 
Relationships 
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Sources: GAO, Nova Development Corp. 



1 Fingerprint Identification Number. 
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c. Milestones are challenging. 

Key US-VISIT milestones are legislatively mandated. For example, the Immigration 
and Naturalization Service Data Management Improvement Act of 2000 1 requires 
that US-VISIT be implemented at all air and sea POEs by December 31 , 2003; at 
the 50 highest volume land POEs by December 31 , 2004; and at all remaining 
POEs by December 31 , 2005. 

Because of limited progress over the last 7 years in addressing entry exit legislative 
requirements, including the above cited milestones, DHS acknowledges that it 
cannot complete permanent solutions in these time frames and thus now plans to 
implement interim, or temporary solutions. For example, as previously described, 
Increments 1 through 3 include the interfacing of existing systems and the design 
and construction of interim facilities at land POEs. Further, DHS officials have 
stated that it will be difficult to develop and implement even the interim solutions at 
some of the highest volume land POEs (such as San Ysidro, CA; Otay Mesa, CA; 
and Laredo, TX) by December 31 , 2004, because even minor changes in the 
inspection time can greatly impact the average wait time at these high-volume 
POEs. 

1 P.L 106-215 (June 15, 2000). 
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d. Potential cost is significant. 

The potential governmentwide cost of US-VISIT over just a 10-year period will likely 
be in the tens of billions of dollars. 

In February 2003, DHS estimated the total overall cost of the US-VISIT program to 
be about $7.2 billion through fiscal year 2014. This estimate includes system 
investment costs, such as IT hardware and communications infrastructure, 
software enhancements and interfaces, as well as the cost of facilities and 
additional inspectors. It also includes system and facilities operation and 
maintenance costs. 
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• The estimate does include the cost of planning, designing, and constructing 
permanent facilities, which according to DHS is about $2.9 billion. 1 This 
estimate is based on the assumptions that (1) no additional traffic lanes will be 
required to support the entry processes and (2) exit facilities will mirror entry 
facilities (i.e., that a land POE with 10 entry traffic lanes will require 10 exit 
traffic lanes). The estimate includes the costs to design and construct building 
space to house additional computer equipment and inspectors, as well as the 
costs for highway reconfiguration at land POEs. 

The estimate does not include the costs to design and construct interim 
facilities at land POEs. DHS officials estimate that the cost of constructing the 
interim facilities at the 50 highest volume POEs is about $218 million. 
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1 The $2.9 billion is a parametric cost estimate. Parametric cost estimating is a technique used in the 
planning, budgeting, and conceptual stages of projects. This technique expedites the development of order 
of magnitude benchmark estimates when discrete estimating techniques are not possible or would require 
inordinate amounts of time and resources to produce similar results. Estimates such as this can vary ±30 
to 50 percent. 
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• The estimate does include the cost of implementing biometrics. However, 
these costs may be understated because it does not include, for example, 
State Department costs. Specifically, in November 2002, 1 we reported that a 
rough order of magnitude estimate of the cost to implement visas with 
biometrics would be between $1 .3 billion and $2.9 billion initially and between 
$0.7 and $1 .5 billion annually thereafter. This estimate is based on certain 
assumptions, including that all current visa-issuing embassies and consulates 
will be equipped to collect biometrics from visa applicants. Assuming that 
biometrics are implemented by December 2004, this means that the recurring 
cost of having biometric visas through DHS's fiscal year 2014 life cycle period 
would be between $7 and $15 billion; in contrast, DHS has estimated a cost of 
about $7.2 billion for the entire program through fiscal year 2014. 
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1 U.S. General Accounting Office, Technology Assessment: Using Biometrics for Border Security, GAO-03- 
174 (Washington, D.C.: Nov. 15, 2002). 
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e. Existing systems have known problems. 

The system performance of US-VISIT Increments 1 , 2, and 3 is largely dependent 
on the performance of the existing systems that are to be interfaced to form it. For 
example, US-VISIT system availability and associated downtime will be 
constrained by the availability of the interfaced systems. In this regard, some of the 
existing systems have known problems that could limit US-VISIT performance. For 
example: 

• Recent reports have identified problems with the availability and reliability of 
SEVIS, which is the Internet-based system designed to manage and monitor 
foreign students in the United States. For example, in April 2003, the Justice 
Inspector General reported that many users had difficulty logging on to the 
system, and that as the volume of users grew, the system became increasingly 
sluggish. 1 Other reports indicated that university representatives complained that 
it was taking hours to log on to the system and to enter a single record, or 
worse, that the system accepted the record and later deleted it. 

1 Statement of Glenn A. Fine, Inspector General, U.S. Department of Justice, "Implementation of the Student 
and Exchange Visitor Information System (SEVIS)" (Apr. 2, 2003). 
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Similarly, we reported in May 2001 1 that CLAIMS 3 is unreliable; this system 
contains information on foreign nationals who request benefits and is used to 
process benefit applications other than naturalization. Specifically, we reported 
that INS officials stated that CLAIMS 3 was frequently unavailable and did not 
always update and store important case data when field offices transferred 
data from the local CLAIMS 3 system to the mainframe computer. 



1 U.S. General Accounting Office, Immigration Benefits: Several Factors Impede Timeliness of Application 
Processing, GAO-01-488 (Washington, D.C.: May 4, 2001). 
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f. Governance structure is not established. 

Our experience shows that one key to successfully implementing large and 
complex modernization programs that involve multiple organizations, such as US- 
VISIT, is to have an executive body, composed of representatives from each 
stakeholder organization, to guide and direct the program. Among other things, this 
body should (1) be formally chartered, (2) include representatives that are 
empowered to make and enforce decisions and commit resources for their 
respective organizations, and (3) be responsible and accountable for the program 
progress and outcomes. 

The US-VISIT program is governmentwide in scope, involving multiple departments 
and agencies. However, it is not currently being guided and directed by a 
governance structure that reflects this program scope. Instead, the program relies 
on a combination of 

• the DHS Investment Review Board (IRB), which is the department's chartered 
investment decisionmaking body, made up of senior leadership from the 
department, and 
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• an integrated project team representing many US-VISIT stakeholder 
organizations (e.g., Customs and Border Protection, the Transportation 
Security Administration, and the State Department). 

However, the IRB's chartered mission and authority governs only DHS activities, 
and does not govern non-DHS, stakeholder activities, such as issuing visas and 
passports, and the integrated project team does not include stakeholder 
representatives who can personally commit resources and make and enforce 
decisions for their respective organizations. Moreover, according to the US-VISIT 
Program Director, who heads the integrated project team, the integrated project 
team's role is basically to advise the US-VISIT program office. 

The Under Secretary for Transportation and Border Security, who is a member of 
the department's IRB, is assigned responsibility and accountability for program 
governance. However, the Program Director stated that a governance body with 
appropriate representation from all relevant program stakeholder organizations 
would benefit the program. Until such a body is established to address important 
crosscutting issues, such as operational decisions and resource needs, US-VISIT 
is at risk of not delivering promised system capabilities and benefits on time and 
within budget. 




GAP 

Accountability * Integrity * Reliability 



Page 69 



GAO-03-1083 Homeland Security 



Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 



" PAD Objective 3 Results 

^ ^ ^ Observations: Program Management 



Accountability * Integrity * Reliability 



g. Program management capability is not implemented. 

Our experience with major modernization programs, like US-VISIT, shows that they 
should be managed as a formal program, which includes establishing a program 
office that is (1) adequately staffed (numbers and skill levels), (2) grounded in 
clearly defined roles and responsibilities, and (3) supported by rigorous and 
disciplined acquisition management processes. 

DHS established a US-VISIT program office in June 2003, 1 and recently 
determined this office's staffing needs to be 1 15 government and 1 1 7 contractor 
personnel (in all) to perform key acquisition management functions. The Software 
Engineering Institute's Software Acquisition Capability Maturity Model (SA-CMM®) 2 
has defined a suite of key acquisition process areas that are necessary to manage 
the system acquisition program in a rigorous and disciplined fashion. These 
process areas include acquisition planning, requirements development and 
management, project management, solicitation, contract tracking and oversight, 
evaluation, and transition to support. 

1 The predecessor program office for the entry exit program was established within the former INS in March 2002. 

2 Carnegie Mellon Software Engineering Institute, Software Acquisition Capability Maturity Model, Version 1 .03 
(March 2002). 
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As of July 10, 2003, the US-VISIT program's staffing levels were far below DHS's 
stated needs. Specifically, the US-VISIT program officials stated that the program 
office has 10 staff within the program office and another 6 staff that are working 
closely with them. Moreover, specific roles and responsibilities have not been 
defined beyond general statements. Further, plans and associated time frames for 
achieving needed staffing levels and defining roles, responsibilities, and 
relationships have not yet been defined. According to the Program Director, 
positions are to be filled with detailees from various DHS component organizations. 
Positions are also to be filled with full-time equivalent slots from other DHS 
components that are not currently filled. 

Additionally, while the approved program office structure (see slide 65) provides for 
positions to perform the SA-CMM® key process areas, including acquisition 
planning, requirements development and management, project management, and 
contract tracking and oversight, none of the process areas have been defined and 
implemented. In the interim, the program office is relying on the knowledge and 
skills of existing program office staff to execute these important acquisition 
functions. 
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According to the Program Director, needed program staffing and key process areas 
are not yet in place because the program is only now getting off the ground, and it 
will take time to establish a fully functioning and capable program management 
capability. Until the program office is adequately staffed, positional roles and 
responsibilities are clearly defined and understood, and rigorous and disciplined 
acquisition process controls are defined, understood, and followed, DHS's ongoing 
efforts to acquire, deploy, operate, and maintain system capabilities will be at risk 
of not producing promised performance levels, functionality, and associated 
benefits on time and within budget. 

The graphic on the next page shows the US VISIT program management structure. 
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Objective 3 Results 
Observations: Program Management 



Approved US-VISIT Program Management Structure 
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■ Mission operations 
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1 



Facilities Management 



- Planning, integration 
and execution 

- Port of entry management 

- Environmental management 

- Lease acquisition 
management 

- GIS management 1 

- Traffic model analysis 

- Interagency requirements 
development 

- Schedule, budget, 
contracts, risk management 



Source: GAO. 



1 A geographic information system (GIS) is a system of computer software, hardware, and data used to manipulate, analyze, and graphically present 
a potentially wide array of information associated with geographic locations. 
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h. Operational context is unsettled. 

To effectively define, establish, and implement a program (particularly one that 
involves restructuring and reengineering the use of people, processes, technology, 
and facilities from physically and culturally divergent organizations), it is essential 
that the program be aligned with a common blueprint, or frame of reference, 
governing key aspects of program operations — e.g., what functions are to be 
performed by whom, when and where they are to be performed, what information is 
to be used to perform them, and what rules and standards will govern the 
application of technology to support them. Such a frame of reference is referred to 
as an enterprise architecture (EA). In brief, an EA defines the operations of an 
enterprise, such as DHS, in both business terms (e.g., policies, processes, 
information, locations) and technical terms (e.g., hardware and software 
standards). It also provides these operational definitions for both the "as is" state 
and the "to be" state, and it includes a transition plan for moving between the two. 
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The operational context, or EA, within which US-VISIT is to exist has not been 
defined. Currently, DHS is developing an EA and reports that it is to be completed 
by October 2003. If developed effectively, the department's EA should provide the 
operational context necessary to effectively define, establish, and make operational 
US VISIT. 

In the absence of an EA, certain policy and standards information that is necessary 
to effectively define, establish, and implement the US-VISIT program is not yet 
available. In particular, policy decisions have not been made governing (1) whether 
official travel documents will be required for all persons who enter and exit the 
country, including U.S. and Canadian citizens, and (2) whether biometrics will be 
captured and used for all persons entering and exiting the country, including U.S. 
and Canadian citizens. Some of these policy decisions may necessitate changes to 
existing laws and regulations. 

Similarly, certain technology standards, such as the number of fingerprints to be 
collected, are only now emerging, with a tentative agreement to use two 
fingerprints and plans to migrate to eight prints for enrollment. Also, the specific 
processes have yet to be defined (e.g., entry and exit procedures and border 
personnel roles and responsibilities relative to implementation of the procedures). 
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Because this operational context is unsettled and unclear, the program office is 
making certain assumptions and decisions necessary to meet near-term deadlines, 
such as the use of a two-fingerprint biometric, and adoption of border crossing 
processes that will implement planned system capabilities in whatever way needed 
to avoid (1) requiring additional facilities and personnel for Increment 1 and 
(2) increasing wait times for traffic crossings. If these assumptions and decisions 
are not aligned with DHS's EA, then near-term investments in systems and 
associated process will need to be reworked or replaced. Moreover, the mission 
value of the planned system capabilities that are actually implemented (made 
operational) at the border could be minimal. For example, inspectors may have to 
limit their use of installed system capabilities (such as those for capturing 
biometrics) to prevent traffic delays. 

Unless DHS can coordinate its plans for developing its EA (and thus providing a 
clear operational context) with its near-term implementation plans for US VISIT, the 
department is increasing its near-term risk of defining, establishing, and 
implementing a program and supporting system that will not cost-effectively meet 
mission needs. 
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I. Near-term facilities solutions pose challenges. 

According to DHS officials, DHS's existing facilities do not adequately support the 
current entry exit process at land POEs. In particular, more than 100 land POEs 
have less than 50 percent of the required capacity to support current inspection 
processes and traffic levels. 1 As a result, as part of US VISIT (increment 2), DHS 
plans to construct interim facilities at about 40 of the 50 highest volume land POEs 
by December 31 , 2004, and construct interim facilities at the remaining portion of 
the 50 by February 2005. To accomplish this, DHS plans to begin awarding design 
contracts in August 2003, and construction contracts in February 2004. 



1 Data Management Improvement Act Task Force, First Annual Report to Congress (Washington, D.C.: 
December 2002). 
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Observations: Near-Term Facilities 



According to DHS officials, the department plans to design and construct interim 
facilities to (1) support the US-VISIT inspection process, technology, and staff 
requirements; and (2) meet current traffic wait time requirements at each land POE. 
To plan for the design and construction of interim facilities that meet these 
requirements, DHS is modeling various inspection process and facilities scenarios 
to define what inspection process to follow and what interim facilities to construct. 
DHS officials told us that preliminary modeling exercises show that 3-, 6-, and 9- 
second incremental increases in average inspection times at some high volume 
land POEs can significantly increase average wait times at these POEs. For 
example, peak wait time at the Blaine Peace Arch POE in Washington could 
increase by more than 1 1 hours if the average inspection increased by 9 seconds. 
The modeling exercise was based on two key assumptions: (1) the current staffing 
level and (2) the current number of inspection booths staffed for each POE. (see 
figure on next slide for modeling results at six POEs). 
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Objective 3 Results 
Observations: Near-Term Facilities 



High-Volume Ports Maximum Vehicle Wait Time as a Function of Added 
Inspection Time 
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Source: DHS. 
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Observations: Near-Term Facilities 



At this point, DHS officials told us that they are planning to satisfy interim facilities 
constraints and requirements by installing temporary booths on existing traffic lanes 
and employing additional inspectors at some of the highest volume land POEs. 1 
However, they also stated that the high traffic volumes and urban locations of some 
land POEs will make meeting US-VISIT constraints and requirements challenging, 
even on an interim basis. Moreover, given existing facilities constraints, developing 
interim facilities plans without defined inspection process, staff, and technology 
requirements introduces considerable uncertainty and risk that resources invested 
in interim facilities may not fully satisfy constraints and requirements and may not 
be useful in the design and construction of permanent facilities. 



1 At this point, DHS is not planning to acquire additional land for interim facilities at land ports of entry. 
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Observations: Value of First Increment 



j. Mission value of first increment is currently unknown. 

OMB Circular Number A-1 1 , part 3, requires that investments in major systems be 
implemented incrementally, with each increment delivering tangible and 
measurable benefits. Incremental investment involves justifying investment in each 
increment on the basis of benefits, costs, and risks. 

DHS is pursuing US-VISIT incrementally, but it has not defined the specific benefits 
to be provided by Increment 1 . 

• The expenditure plan states that Increment 1 will provide "immediate benefits," 
but it does not describe them. Instead, it describes capabilities to be provided, 
such as the ability to determine whether a foreign national should be admitted 
and perform checks against watch lists. It does not describe in meaningful 
terms the benefits that are to result from implementation of these capabilities 
(e.g., X percent reduction in inspection times or Y percent reduction in false 
positive matches against watch lists). 
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Observations: Value of First Increment 



• In fact, because DHS has not yet defined the processes that are to govern the 
extent to which planned Increment 1 system capabilities will be implemented 
(as discussed previously), and because these processes are to be constrained 
by existing facilities and personnel and are not to result in increases in wait 
times for traffic crossings, it is not possible at this point to reliably project 
tangible and measurable Increment 1 mission benefits. 

The expenditure plan also does not identify the estimated cost of Increment 1 . The 
Program Director told us that the $375 million requested in the plan includes not 
only all the funding required for Increment 1 , but also funding for later increments. 
However, the plan does not separate the funds by increment, and program officials 
did not provide this information. 

To DHS's credit, the expenditure plan does identify certain program risks, such as 
not having established clear decision authorities for policy and other operational 
questions and schedule slippage due to the aggressive milestones. However, it has 
yet to address how these risks will be mitigated, and the extent to which the status 
of program risks that are deemed "high impact/high probability of occurrence" will 
be disclosed to program executives. 
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Observations: Value of First Increment 



In February 2003, DHS developed a benefits and cost analysis for the former entry 
exit program. However, this analysis had limitations, such as an absence of 
meaningful benefit descriptions, and program officials acknowledged that it is out of 
date and is not reflective of current US-VISIT plans. According to these officials, an 
updated analysis will be prepared; however, a date and plan for doing so has not 
been set. 

Without a reliable understanding of whether Increment 1 will produce mission value 
commensurate with costs and whether known risks can be effectively mitigated, 
DHS is investing in and implementing a near-term solution that is not adequately 
justified. 
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Conclusions 



The fiscal year 2003 US-VISIT expenditure plan (with related program office 
documentation and representations) either partially satisfies or provides for 
satisfying the legislative conditions imposed by Congress. 

The US-VISIT program leadership has expressly committed to developing and 
implementing the program acquisition management capabilities and the 
expenditure plan content described in our open recommendations. However, much 
remains to be accomplished before these recommendations are fully implemented. 

By definition, US-VISIT is a risky undertaking because it is to perform a critical 
mission, its scope is large and complex, it must meet a demanding implementation 
schedule, and its potential cost is enormous. Generally, these risk factors are 
inherent to the program and cannot be easily changed. 
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Conclusions 



However, compounding these inherent risk factors are a number of others that are 
attributable to the program's current state of governance and management and its 
acquisition approach. These include relying on existing systems to provide the 
foundation for the first three program increments (and thus having to accept the 
performance limitations of these existing systems), not having a governance 
structure to guide and direct the program office, not having a mature program 
management capability, not having stabilized the operational context within which 
the program is to operate (and thus having to make assumptions about this 
context), not having fully defined near-term facilities solutions, and not knowing the 
mission value that is to be derived from the first US-VISIT increment. 

Because of all these risk factors, the ability of US-VISIT to measurably and 
appreciably achieve DHS's stated goals of facilitate legitimate travel and trade, 
enhance national security, and adhere to U.S. privacy laws and policies is 
uncertain. Moreover, DHS's near-term investment in the program is at risk of not 
delivering promised capabilities on time and within budget, and not producing 
mission value commensurate with investment costs. Thus, it is imperative that the 
factors that contribute to this level of risk are addressed thoroughly and 
expeditiously. 
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Recommendations for Executive Action 



To address US-VISIT as a governmentwide program and to minimize the risks 
facing the program, we recommend that the Secretary of Homeland Security, in 
collaboration with cabinet officials from US-VISIT stakeholder departments and 
agencies, 

• establish and charter an executive body, chaired by the Secretary's designee, 
potentially co-chaired by the leadership from key stakeholder departments and 
agencies, and composed of appropriate senior-level representatives from DHS 
and each stakeholder organization, to guide and direct the US-VISIT program; 
and 

• direct this executive body to immediately take steps to (1 ) ensure that the 
human capital and financial resources are expeditiously provided to establish a 
fully functional and effective US-VISIT program office and associated 
management capability, (2) clarify the operational context within which US- 
VISIT must operate, and (3) decide whether proposed US-VISIT increments 
will produce mission value commensurate with costs and risks and disclose to 
the Congress planned actions based on this body's decisions. 



78 



Page 86 



GAO-03-1083 Homeland Security 



Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 



L GAP 

Accountability * Integrity * Reliability 



Recommendations 



Further, we recommend that the Secretary, through the Under Secretary for Border 
and Transportation Security, direct the US-VISIT Program Director to expeditiously 
establish an effective program management capability, including immediately 

• defining program office positional roles, responsibilities, and relationships; 

• developing and implementing a human capital strategy that provides for 
staffing these positions with individuals who have the requisite core 
competencies (knowledge, skills, and abilities); 

• developing and implementing a plan for satisfying key SEI acquisition 
management controls, to include acquisition planning, solicitation, 
requirements development and management, project management, contractor 
tracking and oversight, evaluation, and transition to support; 

• developing and implementing a risk management plan and ensuring that all 
high risks and their status are reported regularly to the executive body; 
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Recommendations 



defining performance standards for each US-VISIT system increment that are 
measurable and reflect the limitations imposed by relying on existing systems 
to form these system increments; and 

developing an analysis of incremental program cost, benefits, and risks, and 
providing this analysis to the executive body, to assist it in the body's 
deliberations and decision-making. 
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We provided DHS a draft of this briefing and discussed its contents with the US- 
VISIT Program Director and Deputy Director. In its oral comments, DHS agreed 
with our findings, conclusions, and recommendations. The department also 
provided some technical comments, which we have incorporated into the briefing, 
as appropriate. Further, the US-VISIT Program Director stated that our work was 
very helpful to him and to the program. 
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Attachment I 
Legislative History 



Legislation 



Key requirements 



Illegal Immigration 
Reform and Immigrant 
Responsibility Act of 
1996 

P.L 104-208 
September 30, 1996 



INS Data Management 
Improvement Act of 
2000 

P.L 106-215 
June 15, 2000 



By September 30, 1998, the Attorney General shall develop an automated entry exit control 
system that — 

(1) collects a record of departure for every alien departing the United States and matches it with 
the corresponding arrival record and 

(2) identifies, through on-line searching procedures, lawfully admitted aliens who overstay their 
visas. 

Overstay information identified through the system shall be integrated into appropriate 
databases of the Immigration and Naturalization Service (INS) and the Department of State, 
including those used at ports of entry and at consular offices. 

Notwithstanding any other provision of federal, state, or local law, a federal, state, or local 
government entity or official may not prohibit or in any way restrict any government entity or 
official from sending to or receiving from INS information regarding the citizenship or 

immigration status, lawful or unlawful, of any individual. 

For the purposes of this section, the term "integrated entry and exit data system" means an 
electronic system that — 

(1) provides access to, and integrates, alien arrival and departure data that are (a) authorized or 
required to be created or collected under law; (b) in an electronic format; and (c) in a database 
of the Department of Justice or the Department of State, including those created or used at 
ports of entry and at consular offices; 

(2) uses available data described above to produce a report of arriving and departing aliens by 
country of nationality, classification as an immigrant or nonimmigrant, and date of arrival in and 
departure from the United States; 

(3) matches an alien's available arrival data with the alien's available departure data; 

(4) identifies, through on-line searching procedures, lawfully admitted nonimmigrants who may 
have remained in the United States beyond the period authorized by the Attorney General; and 
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Attachment I 
Legislative History 



Legislation 



Key requirements 



INS Data Management 
Improvement Act of 
2000 

P.L. 106-215 
June 15, 2000 
(cont'd) 



(5) otherwise uses available alien arrival and departure data described in paragraph (1) above 
to permit the Attorney General to make the reports required under 8 U.S.C. section 1365a(e): 

• Number of departure records collected, with an accounting by nationality. 

• Number of departure records that were successfully matched to records of arrival, with an 
accounting by nationality and classification as an immigrant or nonimmigrant. 

• Number of aliens who arrived pursuant to a nonimmigrant visa, or the Visa Waiver Program, 
for whom no matching departure data have been obtained through the system or by other 
means as of the end of the alien's authorized period of stay, with an accounting by nationality 
and arrival date in the United States. 

• Number of lawfully admitted nonimmigrants identified as visa overstays, with an accounting by 
nationality. 

The Attorney General shall implement the integrated entry exit system at airports and seaports 
by December 31 , 2003. System requirements: 

• include available arrival/departure data, 

• ensure that the arrival/departure data, when collected or created by an immigration officer, are 
entered into the system and can be accessed by other officers at other air/seaports. 

The Attorney General must implement the system at the 50 busiest land border ports of entry by 
December 31 , 2004. System requirements: 

• Same as specified above 

• Arrival/departure data on aliens shall be accessible at other high-traffic land border ports of 
entry. 

The system shall be fully implemented at all remaining ports of entry by December 31 , 2005. 
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Attachment I 
Legislative History 



Legislation 



Key requirements 



Visa Waiver Permanent 
Program Act 

P.L. 106-396 

October 30, 2000 



Not later than October 1 , 2001 , the Attorney General shall develop and implement a fully automated 
entry exit control system that will collect a record of arrival and departure for every alien who arrives 
and departs by sea or air at a port of entry in the United States and is provided a waiver. Not later 
than October 1 , 2002, the system shall enable immigration officers conducting inspections at ports 
of entry to obtain from the system, with respect to aliens seeking a waiver, (1) any photograph of 
the alien that may be contained in the records of the State Department or INS; and (2) information 
on whether the alien has ever been determined to be ineligible to receive a visa or be admitted to 
the United States. 

The system shall maintain, for a minimum of 10 years, information about each application for 
admission made by an alien seeking a waiver. 

On and after October 1 , 2007, the alien at the time of application for admission must have a valid 
unexpired machine-readable passport that satisfies the internationally accepted standard for 
machine readability. 

Countries designated to participate before May 1 , 2000, shall issue machine-readable passports no 
later than October 1 , 2003. 

All Visa Waiver Program (VWP) applicants are to be checked against lookout systems. By October 
1 , 2002, no waiver may be provided to an alien arriving by air or sea at a port of entry on a carrier 
unless the carrier is electronically transmitting passenger data to the entry exit system. 
Not less than 1 hour before arrival at port of entry, signatory aircraft transporting VWP aliens must 
electronically furnish the passenger data required by the Attorney General in regulations. 
The system shall contain sufficient data to permit the Attorney General to calculate, for each 
program country and each fiscal year, the portion of nationals of that country who arrive under VWP 
at air and sea ports of entry but for whom no record of departure exists, expressed as a percentage 
of the total number of such VWP aliens for the particular country. 
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Attachment I 
Legislative History 



Legislation 



Key requirements 



USA PATRIOT ACT 
P.L 107-56 
October 26, 2001 



Aviation and 
Transportation Security 
Act 

P.L 107-71 
November 19, 2001 



Focus of system development shall be on (a) utilization of biometric technology and (b) tamper- 
resistant documents readable at ports of entry. 

The system must be accessible to (a) all consular officers responsible for visa issuance, (b) all 
federal inspection agents at all U.S. border inspection points, and (c) all law enforcement and 
intelligence officers responsible for investigation or identification of aliens. 
The entry exit system must be able to interface with law enforcement databases to be used by 
federal law enforcement to identify and detain individuals who pose a threat to the national security 
of the United States. 

(1) Not later than 60 days after the date of enactment, each air carrier and foreign air carrier 
operating a passenger flight in foreign air transportation to the United States shall provide to the 
Commissioner of Customs by electronic transmission a passenger and crew manifest containing 
the following information: 

• The full name of each passenger and crew member. 

• The date of birth and citizenship of each passenger and crew member. 

• The sex of each passenger and crew member. 

• The passport number and country of issuance of each passenger and crew member if required 
for travel. 

• The U.S. visa number or resident alien card number of each passenger and crew member, as 
applicable. 

• Such other information as the Under Secretary of Transportation for Security, in consultation with 
the Commissioner of Customs, determines is reasonably necessary to ensure aviation safety. 

Carriers may use the advanced passenger information system established under section 431 of the 
Tariff Act of 1930 (19 U.S.C. 1431) to provide the information required by the preceding sentence. 
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Attachment I 
Legislative History 



Legislation 



Key requirements 



Aviation and 
Transportation Security 
Act 

P.L 107-71 
November 19, 2001 
(cont'd) 

Enhanced Border 
Security and Visa Entry 
Reform Act of 2002 
P.L 107-173 
May 14, 2002 



(2) Passenger name records — The carriers shall make passenger name record information 
available to the Customs Service upon request. 

(3) Transmission of manifest — a passenger and crew manifest required for a flight under paragraph 
(1) above shall be transmitted to the Customs Service in advance of the aircraft landing in the 
United States in such manner, time, and form as the Customs Service prescribes. 

(4) Transmission of manifests to other federal agencies — Upon request, information provided to the 
Under Secretary or the Customs Service under this subsection may be shared with other federal 

agencies for the purpose of protecting national security. 

No later than October 26, 2004, the Secretary of State and the Attorney General shall issue to 
aliens only machine-readable, tamper-resistant visas and other travel and entry documents that use 
biometrics. In addition to the requirement for biometric identifiers, name-search capacity and 
support must also be implemented between 18 months and 4.5 years after the date of enactment. 
Not later than October 26, 2004, the Attorney General and Secretary of State shall install at all U.S. 
ports of entry equipment and software to allow biometric comparison and authentication of all U.S. 
visas and other travel and entry documents issued to aliens. 

Not later than January 1, 2003, arrival and departure manifests must be electronically provided to 
appropriate immigration officers for each passenger (including crew members and any other 
occupants) of air and sea carriers at port of entry. 

The information to be provided with respect to each person listed on a manifest shall include 
(1) complete name; (2) date of birth; (3) citizenship; (4) sex; (5) passport number and country of 
issuance; (6) country of residence; (7) U.S. visa number, date, and place of issuance, where 
applicable; (8) alien registration number, where applicable; (9) U.S. address while in the United 
States; and (10) such other information that the Attorney General, in consultation with the 
Secretaries of State and the Treasury, determines as being necessary for the identification of the 
persons transported and for the enforcement of the immigration laws and to protect safety and 
national security. 
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on Homeland Security, Senate and House 
Committees on Appropriations 



O A r\ Attachment II 

^ " Scope and Methodology 



Accountability * Integrity * Reliability 



To accomplish our objectives, we 

• analyzed the expenditure plan against legislative conditions and other relevant 
federal requirements, guidance, and best practices to determine the extent to 
which the conditions were met; 

• analyzed supporting documentation and interviewed program officials to 
determine capabilities in key program management areas, such as acquisition 
planning, enterprise architecture, and project management; 

• analyzed key acquisition management controls documentation and interviewed 
program officials to determine the status of our open recommendations; 

• attended program working group meetings; and 

• assessed DHS's plans and ongoing and completed actions to establish and 
implement the US-VISIT program (including acquiring the US-VISIT system, 
expanding and modifying existing port of entry facilities, and developing and 
implementing policies and procedures) and compared them to existing 
guidance to assess risks. 
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O A r\ Attachment II 

^ " Scope and Methodology 



Accountability * Integrity * Reliability 



We did not independently validate DHS's provided information. 

We conducted our work at DHS headquarters in Washington, D.C., from April 
through July 2003 in accordance with generally accepted government auditing 
standards. 
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U.S. Department of Homeland Security 



September 3, 2003 



Mr. Randolph C. Hite 

Director, Information Technology Architecture 

And Systems Issues 
U.S. General Accounting Office 
441 G Street, NW 
Washington, DC 20548 

Dear Mr. Hite: 

Thank you for the opportunity to review the draft report, Information Technology: 
Risks Facing Key Homeland Security Program Need to Be Addressed (GAO-03-1083). 
We appreciate the time the General Accounting office has taken to review the FY 2003 
spending plan for the United States Visitor and Immigrant Status Technology (US- 
VISIT) Program. Overall, we concur with your recommendations to establish an 
effective program management capability and a proper governance structure. We are 
pleased to report that, subsequent to your findings, significant progress has been made 
in both areas. Nevertheless, we realize that much needs to be done. 

In terms of your specific findings and observations, we believe the US-VISIT 
program has made considerable progress, and we recommend that you consider 
adding these updates to your final report. 

The proposed organizational structure for US-VISIT has received Departmental 
approval. The necessary staff positions have been identified and work has begun with 
the Office of Personnel Management to draft position descriptions and prepare for 
recruitment. Meanwhile, the current staff of 51 includes detailees and dedicated 
personnel from Customs and Border Protection, Immigration and Customs 
Enforcement, other components within the Department of Homeland Security (DHS), 
and other agencies who have been brought on board to ensure that essential work is 
performed pending full staffing with 115 government employees, including 8 senior 
executives. In coordination with the General Services Administration, adequate office 
space has been identified and is being secured. 
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In the area of program governance, a DHS Investment Review Board is already 
in place; US-VISIT was the first program to undergo a review by this board, and it has 
now been reviewed twice. In addition, a DHS policy framework is now in place through 
which important policy questions can be addressed. Finally, we are in the process of 
setting up a US-VISIT Advisory Council. 

If you have any questions, please contact me, or a member of your staff may 
contact Thomas Harner at (202) 305-0845. 



Sincerely, 




James A. Williams 
Director, US-VISIT Program 
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GAO's Mission 



The General Accounting Office, the audit, evaluation and investigative arm of 
Congress, exists to support Congress in meeting its constitutional responsibilities 
and to help improve the performance and accountability of the federal government 
for the American people. GAO examines the use of public funds; evaluates federal 
programs and policies; and provides analyses, recommendations, and other 
assistance to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core values of 
accountability, integrity, and reliability. 



Obtaining Copies of 
GAO Reports and 
Testimony 



The fastest and easiest way to obtain copies of GAO documents at no cost is 
through the Internet. GAO's Web site (www.gao.gov) contains abstracts and full- 
text files of current reports and testimony and an expanding archive of older 
products. The Web site features a search engine to help you locate documents 
using key words and phrases. You can print these documents in their entirety, 
including charts and other graphics. 

Each day, GAO issues a list of newly released reports, testimony, and 
correspondence. GAO posts this list, known as "Today's Reports," on its Web site 
daily. The list contains links to the full-text document files. To have GAO e-mail this 
list to you every afternoon, go to www.gao.gov and select "Subscribe to 
e-mail alerts" under the "Order GAO Products" heading. 



Order by Mail or Phone 



The first copy of each printed report is free. Additional copies are $2 each. A check 
or money order should be made out to the Superintendent of Documents. GAO 
also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single 
address are discounted 25 percent. Orders should be sent to: 

U.S. General Accounting Office 
441 G Street NW, Room LM 
Washington, D.C. 20548 



To order by Phone: 



Voice: (202) 512-6000 
TDD: (202)512-2537 
Fax: (202) 512-6061 



To Report Fraud, 
Waste, and Abuse in 
Federal Programs 



Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm 
E-mail: fraudnet@gao.gov 

Automated answering system: (800) 424-5454 or (202) 512-7470 
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Jeff Nelligan, Managing Director, NelliganJ@gao.gov (202) 512-4800 
U.S. General Accounting Office, 441 G Street NW, Room 7149 
Washington, D.C. 20548 
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